IPv4 Addressing and Subnetting — N10-009 Study Guide

The 32-bit address and what the mask decides

Take the address 192.168.10.130 and the mask 255.255.255.192 and you can answer almost every IPv4 question on this exam: which network it belongs to, what the broadcast is, and how many hosts fit. Everything below is how to read those two numbers.

An IPv4 address is a single 32-bit number, written for humans as four octets (8-bit groups) separated by dots. Each octet holds a value from 0 to 255, because 8 bits express 2^8 = 256 combinations. So 192.168.10.130 is really the bit string 11000000.10101000.00001010.10000010.

The subnet mask splits those 32 bits into a network portion and a host portion. Wherever the mask has a 1 bit, that position belongs to the network; wherever it has a 0 bit, that position identifies a host inside the network. The 1 bits are always contiguous and left-aligned, so a mask is fully described by how many 1s it has. That count is what CIDR (Classless Inter-Domain Routing) notation records: /24 means 24 mask bits set, which is the mask 255.255.255.0. CIDR replaced the old fixed class boundaries and is the way modern addressing is written.

The split is the whole game. With a /24 you have 24 network bits and 8 host bits; with a /26 you have 26 network bits and 6 host bits. More network bits means more, smaller subnets; more host bits means fewer, larger subnets. Two addresses are in the same subnet exactly when their network portions, masked by the same prefix, are identical. The figure shows the boundary moving as the prefix grows.

Note the difference between a subnet mask and a wildcard mask: a wildcard (used in some ACL and routing syntaxes) is the bit-inverse of the subnet mask, so 255.255.255.0 corresponds to wildcard 0.0.0.255. The exam mostly uses subnet masks, but recognize the inverse if it appears.

The subnet mask moves the network/host boundary: more prefix bits make smaller subnets with fewer host addresses.

Public, private (RFC 1918), APIPA, and loopback

Most exam items that show you an address want you to classify it first, because the class of address tells you whether it routes, whether NAT is involved, or whether something has gone wrong.

Private ranges (RFC 1918)

RFC 1918^[1] reserves three blocks for private internets, addresses that are not globally unique and must never appear on the public internet:

Range	CIDR	Span
10.x.x.x	10.0.0.0/8	10.0.0.0 - 10.255.255.255
172.16.x.x - 172.31.x.x	172.16.0.0/12	172.16.0.0 - 172.31.255.255
192.168.x.x	192.168.0.0/16	192.168.0.0 - 192.168.255.255

The trap in the middle row is the boundary: 172.16.0.0/12 covers 172.16 through 172.31, not 172.16 through 172.255. Because these ranges are reusable by every organization, a router must run NAT (Network Address Translation) to map them onto a routable public address before traffic leaves the site. Any address outside these three blocks (and outside the special ranges below) is a public address.

APIPA: the DHCP-failure signal

APIPA (Automatic Private IP Addressing) uses 169.254.0.0/16^[2]. A host that boots, broadcasts a DHCP request, and gets no reply self-assigns an address from this range so it can at least talk to other link-local hosts. Seeing 169.254.x.x is therefore a diagnosis, not a configuration: the DHCP server is unreachable, out of leases, or the relay is misconfigured. An APIPA host has no usable default gateway, so it cannot reach other subnets or the internet.

Loopback

The block 127.0.0.0/8^[3] is loopback: any packet sent to it (almost always 127.0.0.1) is handled by the local TCP/IP stack and never touches the wire. It is how a host tests its own networking software. Because the whole /8 is reserved, 127.0.0.0/8 is never a valid host range on a LAN.

Default gateway

The default gateway is the router interface a host sends traffic to when the destination is not on its own subnet. It must itself be an address inside the host's subnet. A host configured with a gateway outside its subnet, or with no gateway, can reach local hosts but nothing beyond the subnet, which is a common troubleshooting stem.

The flow below is how a host ends up with each kind of address at boot.

A DHCP reply yields a routable lease with a gateway; no reply leaves the host on a 169.254 APIPA address that reaches only the local link.

Address classes A through E and default masks

The exam still tests the legacy class system even though real networks subnet with CIDR, because class boundaries explain default masks and the reserved ranges above.

Before CIDR, the first octet's leading bits fixed the network/host split, giving five classes:

Class	First octet	Leading bits	Default mask	Default prefix	Purpose
A	1 - 126	0	255.0.0.0	/8	Large networks
B	128 - 191	10	255.255.0.0	/16	Medium networks
C	192 - 223	110	255.255.255.0	/24	Small networks
D	224 - 239	1110	n/a	n/a	Multicast
E	240 - 255	1111	n/a	n/a	Experimental/reserved

Three details get tested. First, 127 is skipped between Class A and B because 127.0.0.0/8 is loopback, so Class A is 1 to 126, not 1 to 127. Second, Class D (224.0.0.0/4) is the multicast range and Class E (240.0.0.0/4) is reserved, so neither is assignable to ordinary hosts. Third, 0.0.0.0 and 255.255.255.255 are special: 0.0.0.0 means "this host / any" and 255.255.255.255 is the limited broadcast.

The reason classful addressing was abandoned is waste. A company needing 300 hosts could not use a Class C (254 hosts, too few) so it took a whole Class B (65,534 hosts), stranding tens of thousands of addresses. CIDR and VLSM fix this by letting the prefix be any length, so the same company gets a /23 (510 usable) that fits. On the exam, a question about efficient allocation always wants a custom CIDR prefix, never a class default. Treat classes as background knowledge for reading legacy diagrams and default masks, not as a sizing tool.

Subnetting worked: the magic-number method and VLSM

Here is the routine that answers "what is the network, broadcast, and host range of 192.168.10.130/26?" in under a minute, and it is the same routine for every subnetting item.

Step 1: find the block size (the magic number)

Look at the mask's interesting octet, the last octet that is not 255. For /26 the mask is 255.255.255.192, so the interesting octet is 192. The block size is 256 - (interesting octet), here 256 - 192 = 64. The block size is how far apart consecutive subnets sit, and it is always a power of two.

Step 2: count subnets in blocks

Starting at 0, count up by the block size: 0, 64, 128, 192. Those are the four subnets a /26 carves from 192.168.10.0/24. Find the one your host falls into: 130 lands between 128 and 191, so the subnet is 192.168.10.128.

Step 3: read network, broadcast, and usable range

The network address is the start of the block (all host bits 0): 192.168.10.128. The broadcast is one below the next block (all host bits 1): 192.168.10.191. The usable hosts sit between them: 192.168.10.129 to 192.168.10.190, which is 2^6 - 2 = 62 addresses. That matches the prefix: a /26 has 6 host bits.

The same three steps work for any prefix. The reference table:

Prefix	Mask	Block size	Usable hosts
/25	255.255.255.128	128	126
/26	255.255.255.192	64	62
/27	255.255.255.224	32	30
/28	255.255.255.240	16	14
/29	255.255.255.248	8	6
/30	255.255.255.252	4	2

A /30 deserves its own note: 2 usable hosts is exactly a point-to-point link between two routers, which is why /30 (or /31 per RFC 3021^[4], which allows 2 hosts with no separate broadcast) is the standard for WAN links.

Powers of two, the only table to memorize

Every host-count question is a power of two minus the two reserved addresses:

Host bits (h)	2^h	Usable (2^h - 2)
2	4	2
3	8	6
4	16	14
5	32	30
6	64	62
7	128	126
8	256	254

To size a subnet, find the smallest h whose 2^h - 2 meets the host requirement: 50 hosts needs h = 6 (62 usable, a /26), because h = 5 gives only 30.

VLSM: right-size each subnet

VLSM (Variable Length Subnet Masking) means using different prefix lengths within one address space instead of one mask everywhere. Allocate largest subnet first: from 192.168.1.0/24, a 100-host LAN takes a /25 (192.168.1.0, 126 usable), a 50-host LAN takes a /26 from the remainder (192.168.1.128, 62 usable), and a router link takes a /30 (192.168.1.192). Allocating largest-first prevents a small subnet from splitting a block a large one still needs. The figure walks this allocation.

Exam-pattern recognition

Stems hand you an address and a prefix and ask for the network, broadcast, first usable, last usable, or host count, or they hand you a host requirement and ask for the prefix. The distractors are predictable: off-by-one on the broadcast (giving the next subnet's network instead), forgetting the minus 2 (so 64 instead of 62 for a /26), and the 172.16.0.0/12 boundary (calling 172.32.0.1 private). Run the three steps, subtract 2 for usable hosts, and check the address actually sits inside the block you computed.

VLSM carves 192.168.1.0/24 largest-first into a /25, a /26, and a /30, each prefix sized to the smallest that fits its host count.

Common IPv4 prefixes within a single /24

Prefix (CIDR)	Subnet mask	Block size	Subnets per /24	Usable hosts (2^h - 2)
/24	255.255.255.0	256	1	254
/25	255.255.255.128	128	2	126
/26	255.255.255.192	64	4	62
/27	255.255.255.224	32	8	30
/28	255.255.255.240	16	16	14
/29	255.255.255.248	8	32	6
/30	255.255.255.252	4	64	2

Decision tree

Cheat sheet

Sharp facts the exam loves — give these one last read before exam day.

Cheat sheet

Sharp facts the exam loves — scan these before test day.

An IPv4 address is 32 bits in four octets, each 0 to 255

An IPv4 address is a single 32-bit number written as four dotted-decimal octets, where each octet is 8 bits and so holds a value from 0 to 255 (2^8 = 256 values). That is why no octet can be 256 or higher, a detail exam stems use to flag an invalid address. The four octets together give the roughly 4.3 billion (2^32) addresses of the IPv4 space.

The subnet mask's 1 bits mark the network, its 0 bits mark the host

A subnet mask splits the 32 bits into a network portion (the contiguous, left-aligned 1 bits) and a host portion (the trailing 0 bits). Two addresses are on the same subnet only when their network portions match under the same mask. The mask, not the address alone, is what determines the boundary, so the same address can be in different networks under different masks.

CIDR /n is just the count of mask 1-bits

CIDR (Classless Inter-Domain Routing) notation writes the prefix length after a slash, and it equals the number of 1 bits in the mask, so /24 is 255.255.255.0 and /26 is 255.255.255.192. Converting between prefix and dotted mask is a frequent first step: each full 255 octet is 8 bits, and a partial octet (128, 192, 224, 240, 248, 252) adds the remaining bits. CIDR lets the prefix be any length from /0 to /32, which is what makes classless, right-sized subnetting possible.

3 questions test this

Usable hosts per subnet is 2^h minus 2

For a subnet with h host bits, the block holds 2^h addresses but the all-zeros host address (the network ID) and the all-ones host address (the broadcast) are reserved, leaving 2^h - 2 assignable hosts. A /24 has 8 host bits, so 254 usable; a /26 has 6, so 62 usable; a /28 has 4, so 14 usable. Forgetting the minus 2 is the single most common host-count error.

Trap Answering 2^h (for example 64 for a /26) as the usable host count; the network and broadcast addresses are not assignable, so it is always 2^h - 2.

8 questions test this

The network address has all host bits 0; the broadcast has all host bits 1

Within any subnet, the first address (all host bits 0) is the network ID and cannot be given to a machine, and the last address (all host bits 1) is the directed broadcast for that subnet and also cannot. The usable host range is every address strictly between them. For 192.168.10.0/26 that means network 192.168.10.0, broadcast 192.168.10.63, and usable 192.168.10.1 through 192.168.10.62.

Trap Assigning the network or broadcast address (the .0 or the all-ones host address) to a NIC; both are reserved and a host configured with either cannot communicate normally.

8 questions test this

Find the block size as 256 minus the mask's interesting octet

The magic-number (block-size) method finds subnet boundaries fast: take the mask's interesting octet (the last octet that is not 255) and compute 256 minus it. For /26 the interesting octet is 192, so the block size is 64, and subnets sit at 0, 64, 128, 192. The block size is always a power of two and equals the spacing between consecutive subnets, so you count up in blocks to locate any address.

5 questions test this

Locate a host's subnet by the block it falls into

To find which subnet an address belongs to, count up by the block size until you pass the host octet, then step back one block. For 192.168.10.130/26 the block size is 64, the boundaries are 0, 64, 128, 192, and 130 falls between 128 and 191, so the subnet is 192.168.10.128, the broadcast is 192.168.10.191, and the usable range is 192.168.10.129 to 192.168.10.190. The same three steps work for every prefix.

Trap Reading the broadcast as the next block's network (192.168.10.192) instead of one address below it (192.168.10.191); the broadcast is always block_start + block_size - 1.

9 questions test this

Size a subnet by the smallest host-bit count that fits

When a stem gives a host requirement and asks for the prefix, find the smallest h where 2^h - 2 meets the need, then the prefix is 32 minus h. A 50-host LAN needs h = 6 (62 usable, a /26) because h = 5 gives only 30 usable. Always round up to the next power of two minus two; choosing the exact power without the minus 2 leaves you two short.

Trap Sizing on 2^h >= need instead of 2^h - 2 >= need; for 30 hosts that wrongly picks a /27 boundary as if 32 fit, when after reserving network and broadcast a /27 holds exactly 30 and 31 hosts would need a /26.

5 questions test this

RFC 1918 reserves 10/8, 172.16/12, and 192.168/16 for private use

RFC 1918 defines three private ranges that are not globally routable: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Hosts inside these ranges must be translated by NAT before reaching the internet, which is why the same private addresses are reused by countless organizations. Any address outside these blocks (and outside the special ranges) is a public address.

The 172.16.0.0/12 private block ends at 172.31.255.255

The middle RFC 1918 range, 172.16.0.0/12, spans 172.16.0.0 through 172.31.255.255, covering the second octets 16 through 31 only. Addresses like 172.32.0.1 or 172.15.255.1 are public, not private. This boundary is a favorite distractor because the /12 mask is easy to misread as covering all of 172.x.

Trap Treating 172.32.x.x or any 172.x outside 16 to 31 as private; the /12 covers only 172.16.0.0 to 172.31.255.255, so 172.32.0.1 is a public address.

1 question tests this

A technician is troubleshooting connectivity on a server configured with the IP address 172.31.254.10. Which of the following best…

A 169.254.x.x address means DHCP failed (APIPA)

APIPA (Automatic Private IP Addressing) self-assigns an address from 169.254.0.0/16 when a host requests DHCP and gets no reply. So a 169.254 address is a diagnosis, not a setup: the DHCP server is unreachable, out of leases, or the relay is broken. An APIPA host can reach other APIPA hosts on the same link but has no default gateway, so it cannot reach other subnets or the internet.

Trap Reading a 169.254.x.x address as a valid working configuration; it is a link-local fallback that signals DHCP failure and cannot route off the local segment.

3 questions test this

127.0.0.0/8 is loopback and never leaves the host

The entire 127.0.0.0/8 block is loopback, with 127.0.0.1 the usual address, and any packet sent to it is handled by the local TCP/IP stack rather than the network. Pinging 127.0.0.1 tests whether the host's own networking software works, independent of any cable or NIC. Because the whole /8 is reserved, no loopback address is ever a valid LAN host address.

1 question tests this

A technician runs the command 'ping 127.0.0.1' on a workstation to verify the local TCP/IP stack is functioning. Which of the following…

The default gateway must be an address inside the host's own subnet

The default gateway is the router interface a host uses for any destination not on its local subnet, and it has to be an address within that subnet to be reachable by ARP. A host with a gateway outside its subnet, or with no gateway, can still talk to local hosts but reaches nothing beyond the subnet, a classic 'can ping local, not remote' troubleshooting stem.

Trap Setting the default gateway to an address outside the host's subnet; the host cannot ARP for it, so off-subnet traffic fails while local traffic still works.

A /30 gives exactly 2 usable hosts for point-to-point links

A /30 (mask 255.255.255.252) has 2 host bits, so 2^2 - 2 = 2 usable addresses, which is exactly the two ends of a router-to-router or WAN point-to-point link. RFC 3021 also allows /31 on point-to-point links, giving 2 usable addresses with no separate network or broadcast. Using a /30 for these links conserves address space versus a larger prefix.

Trap Reaching for a /29 or larger on a simple point-to-point link; a /30 already provides the only two addresses such a link needs and wastes none.

Address classes A, B, C use default masks /8, /16, /24

Legacy classful addressing fixes the split by the first octet: Class A (1 to 126) defaults to /8, Class B (128 to 191) to /16, and Class C (192 to 223) to /24. The first octet's leading bits (0 for A, 10 for B, 110 for C) define the class. The exam tests these default masks even though real networks use CIDR, because they explain the reserved ranges and legacy diagrams.

Class A stops at 126 because 127 is loopback

Class A spans first octets 1 to 126, not 1 to 127, because 127.0.0.0/8 is reserved for loopback and sits between Class A and Class B. The 0.0.0.0 address is also special (meaning 'this host' or 'any'), so it is excluded too. These two carve-outs are exactly the kind of off-by-one the exam targets.

Trap Listing Class A as 1 to 127; 127 is loopback, so Class A is 1 to 126.

Class D is multicast (224-239) and Class E is reserved (240-255)

First octets 224 through 239 are Class D, the multicast range (224.0.0.0/4), and 240 through 255 are Class E (240.0.0.0/4), reserved and experimental. Neither is assignable to ordinary hosts: a Class D address names a group, and a Class E address is not used on production networks. An exam answer that offers 224.x or 240.x as a host's unicast address is wrong.

Trap Treating a 224.x to 239.x address as a normal host unicast address; that range is Class D multicast (a group address), not assignable to a single host.

2 questions test this

VLSM right-sizes each subnet, largest allocation first

VLSM (Variable Length Subnet Masking) means using different prefix lengths within one parent block so each segment gets only the addresses it needs. Allocate the largest subnet first: from 192.168.1.0/24 a 100-host LAN takes a /25, a 50-host LAN a /26 from the remainder, and a router link a /30. Going largest-first prevents a small subnet from carving up a block a larger one still needs, avoiding fragmentation.

Trap Allocating the smallest subnets first; a /30 placed early can split a contiguous block so no /25 remains for the largest LAN, fragmenting the space.

2 questions test this

Classful sizing wastes addresses; CIDR/VLSM fixes it

Classful allocation forced a network to take a whole class, so a site needing 300 hosts could not fit a Class C (254) and had to claim a Class B (65,534), stranding tens of thousands of addresses. CIDR and VLSM let the prefix be sized to the need, so that same site takes a /23 (510 usable) instead. A question about efficient or conservative allocation always wants a custom CIDR prefix, never a class default.

255.255.255.255 is the limited broadcast; 0.0.0.0 means this host or any

Two addresses are special beyond the class ranges: 255.255.255.255 is the limited broadcast, reaching every host on the local segment and never forwarded by a router, and 0.0.0.0 means 'this host' or 'any' (a DHCP client sources its first request from 0.0.0.0, and 0.0.0.0/0 is the default route). Neither is assignable to an interface as a normal unicast address.

To make a fixed number of equal subnets, borrow enough host bits so 2^n meets the count

Fixed-length subnet masking creates equal-sized subnets by borrowing host bits, where n borrowed bits yield 2^n subnets. Add those borrowed bits to the original prefix to get the new mask: from /24, borrowing 3 bits gives 2^3 = 8 subnets at /27 (255.255.255.224); from /16, borrowing 4 bits gives 16 subnets at /20 (255.255.240.0).

2 questions test this

IPAM centrally tracks allocations so VLSM subnets never overlap

IP Address Management (IPAM) gives a single record of every subnet and address allocation across the network. In a VLSM design with many different-sized subnets, it is what lets administrators see free space and catch an overlap, such as a /28 carved entirely inside an existing /27, before the conflicting assignment is deployed.

Trap Assuming two subnets cannot overlap just because they have different masks; a smaller subnet can sit entirely within a larger one's range, which only allocation tracking reveals.

2 questions test this

Also tested in

AZ-104 Microsoft Azure Administrator

References

RFC 1918 — Address Allocation for Private Internets Whitepaper
RFC 3927 — Dynamic Configuration of IPv4 Link-Local Addresses (APIPA) Whitepaper
RFC 1122 — Requirements for Internet Hosts (loopback 127.0.0.0/8) Whitepaper
RFC 3021 — Using 31-Bit Prefixes on IPv4 Point-to-Point Links Whitepaper